SYSTEM AND METHOD FOR ESTABLISHING SECURE INTERNET COMMUNICATION CHANNEL FOR AUTHENTICATION FROM A WEB BROWSER

• US 20160301713A1
• Filed: 04/08/2016
• Published: 10/13/2016
• Est. Priority Date: 04/10/2015
• Status: Abandoned Application

• Current Assignee: ID Security LLC
• Original Assignee: ID Security LLC
• Inventors: Krishnamachari, Srivathsan
• Application Number:
  US15/094,170
• Publication Number:
  US 20160301713A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A system and method are provided for establishing a secondary communication channel of communication in the background without explicit user interaction to authenticate the user trying to access resources on a server and the secondary communication channel is triggered by a specially crafted extension in a user accessed URL.

Claims

1. A computer implemented method of forming a secure data communication exchange between a user computer and a website, comprising:

establishing a communication channel between a web browser executed at the user computer and the website;

receiving by a standalone application at the user computer a uniform resource identifier (URI) that includes a special scheme; and

forming an out of band secondary communication channel to authenticate the user computer, wherein the secondary communication channel is triggered by a specially crafted extension in a user accessed Uniform Resource Locator (URL).

2. The computer implemented method of claim 1, wherein the secondary communication channel is triggered by a trigger for opening the secondary channel, and wherein the trigger includes a specially crafted scheme that is part of the URI.

3. The computer implemented method of claim 1, wherein the secondary communication channel connects to a different endpoint on the server.

4. The computer implemented method of claim 1, wherein the secondary communication channel connects to a randomly chosen end point at the same authentication server for each authentication.

5. The computer implemented method of claim 1, wherein the standalone application generates the secondary communication channel independently, and wherein the browser triggers the standalone application, wherein an attempt is made to access resources on a server using the web browser and wherein the secondary communication channel is created without using the browser.

6. The computer implemented method of claim 1, wherein the communication over the secondary communication channel is encrypted.

7. The computer implemented method of claim 6, wherein the encryption is generated using asymmetric public/private key algorithms.

8. The computer implemented method of claim 1, wherein the specially crafted extension is a Multipurpose Internet Mail Extensions (MIME) extension.

9. The computer implemented method of claim 1, wherein the special scheme is provided that outputs to the browser data that informs the browser that the URI should be handed to the application that can handle URIs with the special scheme.

10. The computer implemented method of claim 9, wherein a server address, port and path are identified and generated that inform the application of a destination for the endpoint to connect to in order to initiate the secondary communication channel for authentication.

11. The computer implemented method of claim 1, further comprising:

recognizing by the web browser the special scheme, invoking the external application, and providing the URI to the external application.

12. The computer implemented method of claim 1, wherein the web browser cannot open a file having the special extension, and searches for other applications that recognize the special extension.

13. The computer implemented method of claim 1, the standalone application registers with the web browser about its capability to recognize and process the specially crafted extension.

14. The computer implemented method of claim 1, further comprising after authentication, redirecting by the provider server the web browser to an authenticated URI from which the user can perform transactions with the provider.

15. A system for forming a secure data communication exchange between a user computer and a website, comprising:

a hardware processor that establishes a communication channel between a web browser executed at the user computer and the website;

a hardware processor that processes a standalone application receiving a uniform resource identifier (URI) that includes a special scheme; and

a hardware processor that forms an out of band secondary communication channel to authenticate the user computer, wherein the secondary communication channel is triggered by a specially crafted extension in a user accessed Uniform Resource Locator (URL).

16. A system for forming a secure data communication exchange between a user computer and a website, comprising at least one computer having computer readable memory and a network interface, the at least one computer programmed to:

establish a communication channel between a web browser executed at the user computer and the web site;

receive by a standalone application a uniform resource identifier (URI) that includes a special scheme; and

form an out of band secondary communication channel to authenticate the user computer, wherein the secondary communication channel is triggered by a specially crafted extension in a user accessed Uniform Resource Locator (URL).